Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Description

The input-type cell renderers copy every entry of the renderer’s attributes option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column’s cells.renderer.attributes or cells.editMode.renderer.attributes whose names are event handlers, and those handlers execute in the origin of the page hosting the Grid.

Recommendation

Update the @highcharts/grid-pro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, <= 3.1.0
• Patched version(s): 3.2.0

References

• GHSA-5ghw-9mgr-jvx2
• CVE-2026-116797
• CWE-79
• CAPEC-310